{"id":"GHSA-8948-ffc6-jg52","summary":"Insecure Default Configuration in redbird","details":"Versions of `redbird` prior to 0.9.1 have a vulnerable default configuration of allowing TLS 1.0 connections on `lib/proxy.js`. The package does not provide an option to disable TLS 1.0 which is deprecated and vulnerable.\n\n\n## Recommendation\n\nUpgrade to version 0.9.1 or later.","modified":"2021-08-04T20:58:53Z","published":"2019-06-06T15:32:21Z","database_specific":{"github_reviewed_at":"2019-06-06T13:06:37Z","nvd_published_at":null,"cwe_ids":["CWE-20"],"severity":"MODERATE","github_reviewed":true},"references":[{"type":"WEB","url":"https://github.com/OptimalBits/redbird/pull/207"},{"type":"WEB","url":"https://github.com/OptimalBits/redbird/commit/39c7a2da84a2ddddfe046ea80e98800518920516"},{"type":"WEB","url":"https://snyk.io/vuln/SNYK-JS-REDBIRD-174455"},{"type":"WEB","url":"https://www.npmjs.com/advisories/828"}],"affected":[{"package":{"name":"redbird","ecosystem":"npm","purl":"pkg:npm/redbird"},"ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"last_affected":"0.9.0"}]}],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2019/06/GHSA-8948-ffc6-jg52/GHSA-8948-ffc6-jg52.json"}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N"}]}